[gjkim42]

Summary

• Introduce a Workspace CRD to define git repository configuration (repo, ref, secretRef) as a standalone resource
• Replace inline spec.workspace on Task with spec.workspaceRef referencing a Workspace by name
• Move workspace association on TaskSpawner from taskTemplate.workspace to when.githubIssues.workspaceRef
• Support private repo authentication and GitHub CLI via spec.secretRef on Workspace (injects GITHUB_TOKEN/GH_TOKEN env vars + git credential helper)
• Update CLI: replace --workspace-repo/--workspace-ref flags with single --workspace flag (name of Workspace CR)
• Simplify config file: workspace field is now a string (Workspace resource name) instead of an inline object

Test plan

• Unit tests pass (make test)
• Integration tests pass (make test-integration) — 10 specs including workspace resolution, secretRef injection, and nonexistent workspace error handling
• E2E tests pass (make test-e2e) — updated for Workspace CRD creation and --workspace flag
• Verify axon init produces correct template
• Verify axon run --workspace <name> works end-to-end

🤖 Generated with Claude Code

---

Summary by cubic

Adds a Workspace CRD to centralize git repo/auth and let Tasks and TaskSpawner reference it by name. Controllers resolve the Workspace and set a clear Failed status if it’s missing; the CLI supports --workspace and inline config that auto-creates the Workspace and Secret.

• New Features

  • Workspace CRD (spec.repo, spec.ref, spec.secretRef) with CRDs/RBAC
  • Task now uses spec.workspaceRef; controller fails with a clear message when the Workspace is not found
  • TaskSpawner now uses spec.when.githubIssues.workspaceRef; Deployment parses owner/repo from the Workspace repo URL, passes them via --github-owner/--github-repo, injects GITHUB_TOKEN from Workspace.secretRef; spawned Tasks set workspaceRef
  • Job builder injects GITHUB_TOKEN/GH_TOKEN and uses a git credential helper for clones when a token is present
  • CLI/README: added --workspace; config supports workspace.name or inline repo/ref/token, and auto-creates the Workspace CR and Secret; printer/logs show the Workspace name

• Migration

  • Task: replace spec.workspace with spec.workspaceRef.name
  • TaskSpawner: replace when.githubIssues.owner/repo and tokenSecretRef with when.githubIssues.workspaceRef.name; remove taskTemplate.workspace
  • Reinstall CRDs from install-crd.yaml before applying resources

^{Written for commit afbc314. Summary will update on new commits.}

[cubic-dev-ai]

3 issues found across 21 files

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="internal/controller/job_builder.go">

<violation number="1" location="internal/controller/job_builder.go:170">
P1: Git credential helper missing `username` output. For HTTPS authentication to work, the credential helper must output both `username=` and `password=` attributes. Add `echo "username=x-access-token";` before the password output.</violation>
</file>

<file name="internal/controller/task_controller.go">

<violation number="1" location="internal/controller/task_controller.go:132">
P2: Error handling for workspace fetch doesn't distinguish between `NotFound` (permanent failure) and transient errors. For `NotFound`, returning the error causes endless retries for a non-existent workspace. Consider handling `IsNotFound` separately: mark as Failed and return `nil` (no requeue), while for other errors just return the error without marking as Failed yet.</violation>
</file>

<file name=".claude">

<violation number="1" location=".claude:1">
P2: The new `.claude` file contains a developer-specific absolute path, which is not portable and unnecessarily exposes local filesystem information. This should be removed or replaced with meaningful, repo-relative configuration if intended.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

1 issue found across 4 files (changes from recent commits).

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="internal/controller/taskspawner_controller.go">

<violation number="1" location="internal/controller/taskspawner_controller.go:102">
P2: Status update error is silently ignored, preventing reconciliation retry. This is inconsistent with other status update patterns in this file (lines 126-128, 177-179) which return the error to trigger a requeue. If the status update fails, the TaskSpawner may not reflect the Failed state and won't be reconciled again until something else triggers it.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}